Socket: Fake Braintree NuGet Package Skims Credit Cards

What it is

Braintree.Net, a malicious NuGet package typosquatting PayPal/Braintree's official Braintree .NET SDK (legit package is on the 5.x line, published under braintreepayments). The typosquat uses a mismatched 3.x version scheme; the genuinely malicious releases are 3.35.8–3.36.1, with the first malicious version published July 3, 2026 (Socket flagged it ~10 minutes after publication). It exfiltrates live card data, Braintree merchant API keys, and host secrets to api.348672-shakepay[.]com.

How it works

Three independent exfiltration paths fire at different lifecycle points:

flowchart TD
    A[Assembly load] -->|Module init| B[DependencyInjectorLoader.Load / DependencyInjector.Core.AutoInitializer]
    B --> C[POST env/config/cloud metadata → /api/analytics/report]
    D[gateway.PrivateKey = ...] -->|only if Environment == PRODUCTION| E[POST merchantId, publicKey, privateKey → /api/account]
    F[gateway.CreditCard.Create] --> G[card data skim]

The package ships real-looking Braintree.dll assemblies (net452, netstandard2.0, net8.0, net9.0, net10.0) mirroring the real API surface, so gateways instantiate and return plausible Result<T> objects with no runtime errors. The bundled README is copied from official docs and even says Install-Package Braintree (not Braintree.Net). The private-key theft path only triggers when Environment == PRODUCTION.

Preconditions / Affected

Any app that references Braintree.Net (rather than Braintree). The companion package DependencyInjector.Core ≥ 1.4.1 (pulled in by Braintree.Net 3.36.0+) carries a follow-on token-harvester payload. Transitively compromised downstream packages:

• sipnet@12.8.4, 12.8.5, 12.8.6, 12.8.7
• sipnet.openai.realtime@12.8.3 (indirect, via sipnet)

What to do

• Remove Braintree.Net and DependencyInjector.Core from any project; use the official Braintree package (Install-Package Braintree / dotnet add package Braintree).
• Audit for the affected sipnet / sipnet.openai.realtime versions above.
• Hunt for the malicious class names absent from the legitimate assembly: CardOperationLogger, DependencyInjectorLoader, and any reference to DependencyInjector.Core.
• Block/alert on outbound traffic to api.348672-shakepay[.]com and paths /api/analytics/report, /api/account.
• Treat any merchant privateKey/publicKey/merchantId and host secrets touched by an affected build as compromised — rotate them.

Caveats

The headline reach is heavily inflated: of ~14M reported downloads, ~11M is padding across 120 empty 0.0.x placeholder versions (~93,300 each, all published 2025-10-09) containing only a .nuspec and no DLL. The genuinely malicious releases (3.35.8–3.36.1) have only ~334 real installs — a ~32,900x gap between the download count and the actual blast radius. Socket reported the package and requested removal/publisher suspension, but the page does not confirm takedown.